Using Get-ChildItem to Find Files by Date and Time

As sysadmins (system administrators), we often find ourselves needing to take inventory of the workstations and servers that we manage. We have all likely faced similar questions at some point in our careers. Answers to these questions can be found with the Get-ChildItem command.

Which workstations and servers are getting full on space?

Which user is a disk hog?

Where are all my *.mp3 files?

How many marshmallows can I fit into my mouth at once?

These are important questions. We have all probably had the wonderful opportunity to panic when realizing that we’re getting dangerously low on disk space (or marshmallows).

Sure, disk space is cheaper than ever, but that doesn’t mean we shouldn’t be proactive in keeping our disk space utilized efficiently.

PDQ Inventory does a great job at making reports and creating collections based on disk space. It?s easy to identify who has less than 25% disk space, for example. At a glance, I can tell that my workstation has 77% disk space free. Nifty!

There is a lot of great information here, but what if you want to know whichfiles are the offendingly old/large files that you may be able to delete in order to restore your valuable disk space?

Enter PowerShell!

In order to determine the all the fancy information about a file (its size, who created it, how old it is, etc), we can use the Get-ChildItem cmdlet.

Get-ChildItem

Get-ChildItem lets us list the items of one or more locations. This functionality is very similar to “dir” on Windows and “ls” on Unix-like systems. In fact, “dir” and “ls” are aliases that you can use indirectly in PowerShell in place of Get-ChildItem.

Get-ChildItem has many parameters (link) to help us find our desired results.

–Path String or StringArray – Path of the items to list. The default Path is the current directory.

–FilterString – Filter to apply to the Path

–Recurse – Search recursively through all subdirectories of the provided Path.

This list is not a complete list. It only shows the parameters that we’ll be using today.

Finding Files in Multiple Locations

You can provide multiple paths as a string array or as several paths separated by commas as in the example provided.

Get-ChildItem -Path Path1, Path2

Finding Specific File Types

We can use wildcards to specify specific filetypes. If we wanted to find all .txt files, we could use this:

Get-ChildItem *.txt

Finding Large Files

In this case, we’re going to look at the length (or size) of the files. In this example, I want to show all files larger than 50 KB.

Get-ChildItem | Where-Object {$_.Length -gt 50KB}

The length is in bytes, so we can use a little trick to get the results back in Megabtyes (MB), which is far easier to read. In order to do this, we’ll need to specify the columns by name and then we’ll perform a calculation on the Length column.

Finding Old Files

In this case, we’re going to look at the LastWriteTime for each file. In this example, I want to show all files older than 30 days. In order to do that, we have to get the current date, subtract 30 days and then grab everything less than (older than) the resulting date.

Final Notes

Now, you should be able to find a variety of files in a variety of ways. You can use it to view the file system, the registry or any provider (more info about providers).

You can even take this a step further to delete the found files by piping them into Remove-Item. Just remember that by using the Force parameter, you will have no warning when your files are deleted, so make certain that you know which files you are deleting!